7h3rAm

/* Compile with: g++ -Wall –Werror -o shell shell.c */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <unistd.h>
 
#include <sys/types.h>
#include <sys/wait.h>

7h3rAm

import datetime, re, difflib

def k10(stack):
    if len(stack) <= 1:
        return

    checkHashes, checkDuplicates, checkDelta, checkName = True, True, True, True
    score, dCount, fCount, deltaScore, fnameScore, chainAverage = 65, 0, 0, 0, 0, 0
    duplicates, dChain, fChain, features = [], [], [], [ 'valid_filenames' ]

7h3rAm

"""
    generate domains according to: 
    - https://www.endgame.com/blog/malware-with-a-personal-touch.html
    - http://www.rsaconference.com/writable/presentations/file_upload/br-r01-end-to-end-analysis-of-a-domain-generating-algorithm-malware-family.pdf 

    requires words1.txt and words2.txt
"""
import time
from datetime import datetime
import argparse

7h3rAm

import argparse
from  datetime import datetime

seed_const = 42
days_period = 16
nr_of_domains = 64
third_lvl_min_len = 8
third_lvl_max_len = 15

class Rand:

7h3rAm

import argparse

def get_domains(nr, how_many):
    bases = {
        1: {
            'length': 7,
            'tld': 'com',
            'key': '1676d5775e05c50b46baa5579d4fc7',
            'base': 0x45AE94B2
        },

7h3rAm

import argparse
"""
Shiotob DGA 

Generates domains for the Shiotob malware 

- top level domains alternate between '.net' and '.com'
- domains are between 14 and 19 characters long
- domains consist of all letters and digits 123945

7h3rAm

#!/bin/bash
# bash generate random alphanumeric string
#

# bash generate random 32 character alphanumeric string (upper and lowercase) and 
NEW_UUID=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)

# bash generate random 32 character alphanumeric string (lowercase only)
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1

7h3rAm

Credit card challenge

Exercise: https://gist.github.com/jorin-vogel/2e43ffa981a97bc17259

7h3rAm

Volatility Learning Resources

• Volatility - An advanced memory forensics framework
• Introduction to Volatility
• Volatility | Linux Forensics

Learning Exercises & Examples

• Honeynet | Challenge 7 Forensic Analysis of a Compromised Server
• Google Code | SampleMemoryImages

7h3rAm

alias radio_news="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/news.pls" # MPR News
alias radio_current="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/the_current.pls" # The Current
alias radio_classical="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/classical.pls" # Classical MPR
alias radio_localcurrent="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/local.pls" # Local Current
alias radio_heartland="mplayer -playlist http://minnesota.publicradio.org/tools/play/streams/radio_heartland.pls" # MPR Radio Heartland
alias radio_defcon="mplayer http://sfstream1.somafm.com:6200/"
alias radio_radiopecs="mplayer http://80.237.154.83:8120"
alias radio_wonderground="mplayer http://wondergroundstream2.publicradio.org/wonderground" # MPR Wonderground Windows Media
alias radio_choral="mplayer -playlist http://choralstream1.publicradio.org/choral.m3u" # Clasical MPR Choral
alias radio_wefunk="mplayer -playlist http://www.wefunkr